Information security policy

{
  "id": "MLC-T-CYB-002123",
  "term": "Information security policy",
  "field": "Cybersecurity",
  "definition": "1. Aggregate of directives, regulations, rules, and practices that prescribes how an organization manages, protects, and distributes information.\n\n2. Aggregate of directives, regulations, and rules that prescribe how an organization manages, protects, and distributes information.\n\n3. A high-level policy of an organization that is created to support and enforce portions of the organization’s Information Management Policy by specifying in more detail what information is to be protected from anticipated threats and how that protection is to be attained.",
  "references": [
    "NIST SP 800-12 Rev. 1 from CNSSI 4009; NIST SP 800-128 from CNSSI 4009; NIST SP 800-18 Rev. 1 [Superseded] from CNSSI 4009; NIST SP 800-37 Rev. 1 [Superseded] from CNSSI 4009; NIST SP 800-53 Rev. 4 [Superseded] from CNSSI 4009; NIST SP 800-53 Rev. 5 from CNSSI 4009-2015, CNSSI 4009-2022; NIST SP 800-53A Rev. 5 from CNSSI 4009-2015, CNSSI 4009-2022",
    "CNSSI 4009-2015; CNSSI 4009-2022",
    "NIST SP 800-152",
    "NIST CSRC Glossary"
  ],
  "url": "https://mlchart.com/terminology/cybersecurity/information-security-policy/"
}